search

Azure / PSRule.Rules.Azure

Rules to validate Azure resources and infrastructure as code (IaC) using PSRule.
https://azure.github.io/PSRule.Rules.Azure/
MIT License
400 stars 87 forks source link

[BUG] Export-AzPolicyAssignmentRuleData unable to export Azure policy as PSRule (The function "field" was not found) [Microsoft policy ID: fbb99e8e-e444-4da0-9ff1-75c92f5a85b2] #2725

Closed Marc013 closed 9 months ago

Marc013 commented 9 months ago

Existing rule

No response

Description of the issue

Unable to export policy assignment data to PSRule.

PolicyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/fbb99e8e-e444-4da0-9ff1-75c92f5a85b2 DisplayName: Storage account containing the container with activity logs must be encrypted with BYOK

Error messages

An error occurred evaluating expression '[contains(field('Microsoft.Insights/logProfiles/storageAccountId'), subscription().Id)]' line 11105. The function "field" was not found.

Reproduction

Exporting policy assignment data of Microsoft policy /providers/Microsoft.Authorization/policyDefinitions/fbb99e8e-e444-4da0-9ff1-75c92f5a85b2

Version of PSRule

2.9.0

Version of PSRule for Azure

1.33.2

Additional context

This bug is related to #1323

BernieWhite commented 9 months ago

@Marc013 Currently it's not possible for PSRule to coordinate over different resources, so this is not enforceable in code.

We will add this policy definition to the ignore list so that there is no error and a warning will be generated instead as the fix.

In the interim you can set the AZURE_POLICY_IGNORE_LIST configuration option.